DEV Community

Anoymask
Anoymask

Posted on

Ivanti Neurons for ITSM and Sentry: Unauthenticated Deserialization RCE and Administrative Authentication Bypass

#security #threatintel

1. Basic Information

2. Executive Summary

Ivanti fixed eight Neurons for ITSM vulnerabilities, including two unauthenticated deserialization RCE issues, and a Sentry authentication bypass permitting unauthenticated administrative access. In-the-wild exploitation remains unconfirmed.

3. Attack Flow

ITSM: CVE-2026-12744 and CVE-2026-12745

  1. A remote unauthenticated attacker reaches an affected ITSM installation.
  2. Exploitation of untrusted-data deserialization can execute arbitrary code on the server. The precise request format is not established in this report.

Sentry: CVE-2026-83527

  1. A remote unauthenticated attacker reaches an affected Sentry service.
  2. An alternate path or channel bypasses authentication and grants administrative access. This is not a step following the ITSM exploit.

4. Attacker Position and Execution Environment

  • For ITSM CVE-2026-12744/12745 and Sentry, the attacker can reach an affected service without prior authentication; processing occurs on the respective server. The other six ITSM issues and the EPMM issue require prior authentication.

5. What Users and Administrators May See

Users

  • The ITSM and Sentry vulnerabilities discussed here do not require a victim click.

Administrators

  • Inference: Suspicious server activity or administrative operations without corresponding legitimate authentication can provide leads. A crash alone is not proof of RCE.

6. Success Conditions and Risk Reduction

Success Conditions

  • ITSM exploitation requires a configuration affected by CVE-2026-12744/12745 and access to the vulnerable service.
  • Sentry exploitation requires a configuration affected by CVE-2026-83527 and access to the relevant service. It is separate from ITSM code execution.

Failure Conditions and Risk Reduction

  • For on-premises ITSM, apply the September 2026 Security Patch matching the 2025.2, 2025.3, 2025.4, or 2026.1 branch. Do not base remediation on waiting for version 2026.2, scheduled for September 21. Ivanti states that cloud/SaaS environments were patched on August 9.
  • Update Sentry to R10.8.2, R10.7.3, R10.6.4, or the applicable later fixed release, and restrict access to management interfaces.
  • Update EPMM to the fixed release for its branch: 12.10.0.0, 12.9.0.2, or 12.8.0.4.

7. Potential Impact

  • Remote code execution on an ITSM server.
  • Unauthenticated administrative access to Sentry.

8. Observable Logs

Inference: These are investigation sources and their collection requirements.

  • Email: Email is not required for these unauthenticated server attacks. Review it only where evidence links a separate entry path.
  • Proxy/SWG/DNS: Use WAF, reverse-proxy, and web access logs to inspect request targets, timestamps, and responses. Serialized request contents cannot be checked where bodies were not captured.
  • Endpoint/EDR: On managed servers, inspect service processes, child processes, files, and configuration changes. On appliances, use supported audit and diagnostic facilities.
  • Identity/IdP: Compare Sentry administrative activity with authentication records. For EPMM, inspect the pre-existing authenticated session as well.
  • SaaS/Cloud: Use ITSM, Sentry, and EPMM audit records to trace configuration, data, and connected-system access, selecting sources appropriate to deployment.
  • Network: Review inbound sources, outbound connections, and access to managed systems. Traffic alone cannot establish code execution.

9. Assessing Attack Success

The following are evidence criteria for an individual investigation, not claims that each stage occurred. See Facts and Unknowns for the reported scope.

  • Attempt observed (success unconfirmed): Evidence criterion: Confirm crafted requests or suspicious management connections. Separate receipt from successful exploitation.
  • User interaction confirmed: Evidence criterion: A victim click is not required for the two ITSM issues or Sentry. Do not confuse this with EPMM’s authentication prerequisite.
  • Initial execution confirmed: Evidence criterion: For ITSM, require process, memory, or equivalent execution evidence. Starting input processing or crashing is insufficient.
  • Malware execution or authentication success confirmed: Evidence criterion: For Sentry, confirm administrative activity without legitimate authentication. This is a different success condition from ITSM RCE.
  • Data theft or session compromise confirmed: Evidence criterion: Individually confirm retrieval or exfiltration of sensitive data or credentials. Administrative access alone does not prove disclosure.
  • Follow-on compromise confirmed: Evidence criterion: Confirm unauthorized account changes or further intrusion into managed systems. Do not infer lateral movement from possibility alone.

10. Investigation Playbook

Inference: Operational recommendations based on the described behavior.

  • Trigger: Suspicious ITSM requests associated with server execution, or unauthorized Sentry administrative access.
  • Initial Checks: Distinguish product, release branch, patch level, and connection sources for ITSM, Sentry, and EPMM.
  • Endpoint: On managed servers, inspect service processes, child processes, files, and configuration changes. On appliances, use supported audit and diagnostic facilities.
  • Identity and Cloud: Compare Sentry administrative activity with authentication records. For EPMM, inspect the pre-existing authenticated session as well. Use ITSM, Sentry, and EPMM audit records to trace configuration, data, and connected-system access, selecting sources appropriate to deployment.
  • Follow-on Activity: Confirm unauthorized account changes or further intrusion into managed systems. Do not infer lateral movement from possibility alone.
  • Containment: Apply branch-appropriate fixes and restrict management access. Where compromise is evidenced, isolate affected systems and review exposed credentials and integrations.
  • Classification: Distinguish contact, execution, abuse of privileges, data collection, and follow-on compromise using evidence. Missing logs do not prove that compromise did not occur.

11. Defense and Detection Ideas

Inference: Operational recommendations based on the described behavior.

  • Single Event: Suspicious ITSM requests associated with server execution, or unauthorized Sentry administrative access.
  • Time-Series Correlation: For ITSM, trace request, server execution, and outbound traffic. For Sentry, trace connection, unauthenticated administrative activity, and configuration changes.
  • Threat Hunting: Start with unpatched ITSM and Sentry systems and inspect suspicious requests, execution, and administrative operations before and after patching.
  • Logging Gaps: On managed servers, inspect service processes, child processes, files, and configuration changes. On appliances, use supported audit and diagnostic facilities. Review inbound sources, outbound connections, and access to managed systems. Traffic alone cannot establish code execution.
  • Priority Controls: For on-premises ITSM, apply the September 2026 Security Patch matching the 2025.2, 2025.3, 2025.4, or 2026.1 branch. Do not base remediation on waiting for version 2026.2, scheduled for September 21. Ivanti states that cloud/SaaS environments were patched on August 9. Update Sentry to R10.8.2, R10.7.3, R10.6.4, or the applicable later fixed release, and restrict access to management interfaces. Update EPMM to the fixed release for its branch: 12.10.0.0, 12.9.0.2, or 12.8.0.4.

12. Facts / Inference / Hypothesis

Facts

  • Ivanti’s ITSM advisory lists eight issues: three missing-authorization flaws and five untrusted-data deserialization flaws. CVE-2026-12744 and CVE-2026-12745 permit unauthenticated RCE (CVSS 9.8); the other six require prior authentication.
  • For on-premises ITSM 2025.2, 2025.3, 2025.4, and 2026.1, Ivanti provides a September 2026 Security Patch for each branch. Version 2026.2 will include the fixes but is scheduled for September 21, 2026; it is not an already available upgrade as of September 10.
  • For cloud/SaaS ITSM, the advisory lists 2026.2 as affected and mo2026.2 as resolved. Ivanti states that all environments were patched on August 9, 2026, and no customer action is required.
  • Ivanti states that it was not aware of exploitation affecting customers at disclosure for these eight ITSM issues.
  • Sentry CVE-2026-83527 is an authentication bypass allowing a remote unauthenticated attacker to obtain administrative access.
  • Ivanti’s CVE record describes EPMM CVE-2026-18851 (CVSS 8.8) as missing authorization (CWE-862) that allows a remote authenticated attacker to escalate privileges to administrator. The fixed releases for the respective branches are 12.10.0.0, 12.9.0.2, and 12.8.0.4.

Inference

  • The investigation, success-assessment, and defense recommendations are derived from public information. They are not observations of real-world compromise.

Hypothesis

No additional hypotheses. Unresolved points are listed under Unknowns and Further Investigation.

13. MITRE ATT&CK Mapping

  • T1190 Exploit Public-Facing Application (high confidence): Limited to attacks against the ITSM and Sentry services. Whether a particular deployment is internet-facing must be assessed separately.

14. Unknowns and Further Investigation

  • Specific endpoints, serialized formats, and reliable IOCs for each CVE.
  • In-the-wild exploitation, public PoCs, and attackers.

15. Impact on SOCs and Organizations

Prioritize ITSM as a management platform that concentrates assets, credentials, and automation. Assess VPN and third-party access paths as well as internet exposure, and review SSO authentication and authorization settings.

16. Audience Summaries

  • SOC: For ITSM, trace request, server execution, and outbound traffic. For Sentry, trace connection, unauthenticated administrative activity, and configuration changes.
  • Administrators: Apply branch-appropriate fixes and restrict management access. Where compromise is evidenced, isolate affected systems and review exposed credentials and integrations.
  • Users: Ordinary users do not need to run PoCs. Report service anomalies to administrators.

Top comments (0)